Chapter 3

Chapter 4

There is an error in Chapter 4 page 64 as pointed out by Sam Bowne.

Late night writing must have got me, when I am describing slack space I incorrectly create a scenario that would have only included RAM Slack and not Slack of the file itself. RAM Slack means that to fill out the area of the last sector being written to Windows would write out contents of memory to the disk. RAM Slack since Windows XP stopped containing actual RAM and instead has been filled with NULLs. If more than one sector was allocated to an old file and the new file that overwrote it left whole sectors unused then just those additional sectors would contain File Slack or the contents of the old file.

Chapter 8

If you are confused why in the Raptor section you can’t write your image to any partition, I somehow left the mounting step out. Before imaging pick the ‘mount’ tab and choose the partition you are going to write your evidence too and make sure to pick ‘allow changes’. Once complete the mounted partition will appear as a destination on the ‘Image’ tab.